Data backups of industrial devices and entire control systems can be stored in a cloud, for example on a cloud storage system. In the case of a problem with the local control system, data including operating system, control system and customer-specific configurations can be restored from the remote backup stored in the cloud. Often there is a significant amount of similar or even identical backup data, for example operating system files, control system software, standard software, etc. between different customers and between different backups.
Generally, cloud storage system are designed towards the trade-offs confidentiality versus space: On the one hand, if the data is stored in an encrypted way, the customer owns the encryption key. However, the encrypted data from each tenant typically differs, and, depending on the encryption algorithm, even from backup to backup. On the other hand, a cloud storage system that stores the data in an unencrypted way can reduce the storage space significantly by eliminating the storage of duplicate data. Practically, the backup storage space can be reduced by 90 to 95% for operating system files, control system software and standard software.
Storing the backup data in an unencrypted faces the problem of customer acceptance: Customers are reluctant to send their sensitive data to an unknown server that stores it without protection. Besides that, highly sophisticated targeted attacks may nowadays compromise clouds. Thus, any cloud offering in this area must offer data confidentiality to such an extent that even the service provider is not able to reconstruct the clear text of customer-owned data without the customer being involved.
US 2013/246790 A1 describes a storage method comprising encrypting data with a storage key to obtain encrypted data, encrypting the storage key with two different encryption methods to generate a personal key and a data key, respectively, wherein the personal key can be decrypted with a key from the user who owns the data to obtain the storage key, and the data key can be decrypted with the unencrypted data to obtain the storage key, and saving the encrypted data, personal key and data key in a server.
However, as outlined before the straightforward method of storing data that is encrypted with a customer's key faces the problem of massive data duplication: large quantities of data of different customers are identical and there is even more duplication between daily backups of the same customer. Duplications reduce the overall margin due to the costs for data storage. The backup also takes a longer time and requires more bandwidth, for example, if a complete server image is uploaded daily or even hourly.